The question a detection system actually answers
An operator cannot see a customer's income, their relationships, their mental health or their intentions. It can see what they do in its own product, in detail, continuously. Behavioural detection is the discipline of turning that one visible stream into a defensible judgement about risk.
It is worth being precise about what such a system can and cannot produce. It cannot diagnose. It cannot establish affordability. It cannot tell you what is happening in a customer's life. What it can do is identify customers whose behaviour has changed in ways that are associated with harm, and rank them so that finite human attention goes to the right accounts first.
That is a narrow claim, and it is the claim to make. Systems that are described as identifying problem gamblers are overselling, and they are overselling in a document a regulator may later read.
Change beats level
The most common design error in this field is building a system around thresholds on levels: deposit more than X, play more than Y hours, trigger an alert.
Levels are a poor signal on their own for a simple reason. A customer who has deposited the same amount every month for three years, comfortably within their means, will breach a level threshold and generate an alert that is almost always a false positive. Meanwhile a customer whose deposits have quadrupled in a fortnight, from a low base, may never cross the threshold at all, and that is the customer whose life has changed.
Harm is usually preceded by a change in behaviour. The customer is the best baseline for the customer. A detection system built on deviation from an individual's own established pattern will outperform one built on population thresholds, and it will do so while generating fewer alerts.
This does not mean levels are useless. Absolute thresholds have a role as a backstop, particularly where a level is high enough that it demands attention whatever the history. But a system in which levels do the primary work will be simultaneously noisy and blind.
The markers worth knowing
The following are the behavioural indicators that appear consistently in research, in regulatory guidance and in operator practice. Knowing them individually matters less than knowing why each one is informative.
Chasing. Increased stakes or session length immediately following a significant loss, particularly a deposit made within minutes of a large loss. This is the single most important marker in the set. It is a direct behavioural expression of loss aversion and sunk cost, it is measurable without ambiguity, and it is associated with harm across the literature. If a system detects one thing, it should detect this.
Escalation. A rising trend in deposit frequency, deposit size, stake size or session duration over weeks. The trend matters more than any single point in it.
Session length and session pattern. Long sessions, and particularly sessions that extend past the customer's own normal stopping point. A customer who habitually plays for thirty minutes and now plays for three hours has changed.
Time of day. Play at night, and specifically play in the small hours, is associated with harm. It is also associated with shift work, insomnia and time zones, so it is a weak marker alone and a useful one in combination.
Reduced gaps. Shortening intervals between sessions, and the disappearance of days with no play at all. A customer who used to have gambling-free days and no longer does has changed in a way that is easy to measure and easy to miss.
Deposit velocity and multiple deposits in a session. Several deposits within a single session, particularly of increasing size, indicates the customer is repeatedly deciding to add money they had not planned to add.
Failed and declined deposits. A declined card is a strong signal, because it frequently means the customer has run out of available funds and is still trying. Multiple declines followed by a successful deposit from a different instrument is stronger still.
Multiple payment instruments. A growing number of cards or accounts, particularly added in quick succession, is associated with exhausted funds and with borrowing.
Cancelled withdrawals. A customer who requests a withdrawal and then reverses it to continue playing has explicitly changed their mind about stopping. The reverse-withdrawal facility exists to enable this, which is why several jurisdictions have restricted it, and why its use is such a clean marker.
Limit behaviour. Requesting an increase to a deposit limit, particularly repeatedly, particularly soon after setting one, and particularly at the moment the existing limit binds. Cancelling a limit entirely is stronger.
Tool use and reversal. Setting a time-out and then returning immediately. Beginning a self-exclusion and abandoning it. Contacting support to have a control removed.
Erratic play patterns. Sudden switching between products, particularly from lower-frequency to higher-frequency products, and sudden changes in stake distribution within a session.
Customer contact. Complaints referencing money, requests for refunds, mentions of losses, expressions of frustration or distress in chat or email. This is the highest-value signal in the entire set because it is the customer telling you directly, and it is the one most often lost, because it sits in a support system that does not talk to the risk system.
Combining markers: the part most systems get wrong
Individual markers are weak. Their value is in combination, and combination is where the design decisions live.
Rule stacks count markers and act above a threshold. They are transparent, explainable to a regulator, auditable, and easy to defend. They are also blunt, they treat every marker as equally informative, and they are gamed by anyone who understands them.
Weighted scoring assigns each marker a weight and produces a continuous risk score. More expressive, still explainable, but the weights have to come from somewhere and they are frequently set by committee rather than by evidence.
Statistical and machine-learned models fit a model against an outcome. Substantially better at ranking, given a decent outcome variable, and substantially harder to explain. The critical question, which is almost never asked hard enough, is what the model was trained to predict.
That last point deserves its own paragraph, because it is where the most serious failures occur. If a model is trained to predict self-exclusion, it learns to identify customers who self-exclude, which is a group that both overlaps with and differs from customers experiencing harm. If it is trained to predict complaints, it learns to find complainers. If it is trained on customers who were previously flagged by a rule stack, it learns to reproduce the rule stack including its blind spots. A model is only as good as the definition of harm it was pointed at, and most available outcome variables are proxies with known biases. Say so out loud, in the model documentation, before someone else says it for you.
Base rates, false positives and the cost of being wrong
This is the part that separates a functioning programme from an expensive one.
The population experiencing serious harm is a small proportion of any operator's customer base. When the base rate is low, even a test with good sensitivity and specificity produces a majority of false positives among its alerts. This is not a flaw in a particular system; it is arithmetic, and no amount of model quality removes it entirely.
The consequences are practical. A system tuned to catch everything produces an alert volume that no human team can action, which means alerts are closed without meaningful review, which means the operator has documented, in its own systems, that it identified risk and did nothing. That record is considerably worse than having had no system at all, and it appears in enforcement notices.
The remedy is not to tune the system down until the volume is comfortable. It is to build a response that matches the signal strength.
Tier the response to the confidence. A weak signal warrants an automated, low-cost, low-friction action: a targeted message, a prompt to review limits, a suppression of marketing. A strong or repeated signal warrants a human contact. A very strong signal warrants immediate restriction pending contact.
Size the human capacity to the strong-signal volume, then set the threshold to that capacity. Doing it the other way round guarantees a backlog.
Measure the closure quality, not the closure rate. A team closing every alert within the service level is not evidence of anything.
The cost of a false negative is a customer harmed and, in a regulated market, a penalty. The cost of a false positive is a contacted customer who was fine, some friction, and possibly a complaint. Those costs are not symmetric, and the tuning should reflect that they are not, but a programme that ignores false-positive cost entirely will drown and stop working.
Identity resolution: the silent failure
Every marker in this lesson is computed per account. If one person holds several accounts, each one shows a fraction of the behaviour and none of them trips anything.
This is a bigger problem than most operators acknowledge. Multi-accounting within a single brand, accounts across brands in the same group, and accounts across the market all fragment the picture. Group-level identity resolution is achievable and frequently is not done, because the brands are operated separately and the data is not joined. Market-level resolution requires a central register or a data-sharing scheme, which exists in some jurisdictions and not in most.
An operator that has not resolved identity across its own brands has a detection system reporting on fragments and should not present its outputs as a view of the customer.
Evaluating whether any of it works
Detection is a means. The end is a change in the customer's behaviour and, ultimately, in their outcome. Most programmes measure the means.
Weak measures. Alerts generated. Interactions completed. Time to closure. Tools promoted. These describe activity, not effect, and an operator reporting them as evidence of effectiveness is reporting that it was busy.
Better measures. Change in the flagged behaviour after the intervention, measured over a meaningful window. Rate of recurrence. Proportion of flagged customers who subsequently set or lowered a limit, or self-excluded, and what happened next. Proportion who escalated despite contact.
Best, and hardest. A comparison against a counterfactual. Where an operator can construct a defensible comparison group, whether through a staged rollout, a randomised assignment of intervention type, or a natural experiment created by a system change, it can make a genuine causal claim about what its interventions do. Very few operators do this, the ethical constraints on withholding an intervention are real and must be respected, and the ones that navigate it have evidence nobody can argue with.
The honest summary of the field is that detection has improved considerably and evaluation has not kept pace. An operator that can demonstrate, with evidence, that its interventions change behaviour is in a small minority, and that is where the competitive and regulatory advantage now sits.